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PRE- APPEAL BRIEF REQUEST FOR REVIEW 

In the Final Office Action dated June 23, 2005 and the Advisory Action dated October 5, 
2005, the Examiner continued to reject each of pending claims 1-46, 1 14-157, 178-261, 304-353, 
377-418, 438-460, and 476-585 under 35 U.S.C. § 102(b) as being anticipated by U.S. Patent 
No. 5,835,726 issued to Shwed et al. ("Shwed"). As discussed in Applicant's Response to Final 
Office Action dated August 5, 2005 ("Applicant's Response"), the office action however does 
not even address most of the claims in the application, much less present a prima facie case for 
the rejections. As to the claims that are addressed, there is clear error in the rejections. 

I. Independent claims 1, 24 and 438 and their respective dependent claims 

Claim 1 is directed to an information management system that includes a plurality of 
workstations adapted for connection to a computer network, and a data repository arranged to 
receive data from each of said workstations. The system includes policy data containing rules 
defining relevant commercial data which is to be stored in said data repository. The system also 
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includes an analyser for monitoring at least one of said outbound data and said inbound data, to 
identify in at least one of said outbound data and said inbound data, relevant commercial data 
that is to be stored in said data repository in accordance with said rules in said policy data, and to 
cause said relevant commercial data to be stored in said data repository. The system thereby 
identifies and stores relevant commercial data from inbound and/or outbound data transmitted or 
received by said workstations. (Non-limiting examples of such commercial data can include 
passwords/usernames, digital certificates, URLs, web pages, transaction amounts, goods and 
services, and transaction dates). 

Shwed, on the other hand, discloses a packet filter for controlling information flow on a 
network to improve security . As explained, e.g., in the abstract of the reference, an incoming 
packet is judged against a filter language instruction and actions are taken accordingly. A packet 
may be rejected or accepted, or logged. If a packet is accepted, it may be modified by 
encryption, decryption, signature generation, signature verification or address translation. Shwed 
is thereby only concerned with security; Shwed does not analyze inbound or outbound data from 
or to a workstation to identify any relevant commercial data or store identified relevant 
commercial data in a data repository. 

The incoming packets of Shwed that are trapped and processed are not themselves 
relevant commercial data. Even if, for the sake of argument, one were to consider Shwed' s 
packets to be relevant commercial data, the elements of claim 1 would still not be met by the 
reference. Shwed would still not disclose "policy data containing rules defining relevant 
commercial data" as specified in claim 1. The rules in Shwed define the packets themselves only 
in terms of destination, sender addresses and service type , and not in terms of any relevant 
commercial data . 

Additionally, an interpretation of the packets as relevant commercial data would mean 
that the modifying or logging of the packets be relevant commercially, and yet the only need to 
stop packets disclosed in Shwed is security. There is therefore no storage of relevant commercial 
data. Furthermore, no description is given in Shwed of what logging a packet on the system 
entails. It could just be an entry that a packet was detected and modified, rather than the packet 
itself. Claim 1 and its dependent claims 2-23 are therefore patentable over Shwed. 
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Moreover, as discussed in further detail in Applicant's Response (pages 3-4), with respect 
to dependent claim 9, Shwed further does not disclose or suggest identification or storage of 
digital certificates . 

As discussed in Applicant's Response (page 4), independent claims 24 and 438 also 
generally relate to identifying and storing relevant commercial data. These claims and their 
respective dependent claims are similarly patentable over Shwed. 

II. Independent claims 114, 136 and 476 and their respective dependent claims 

None of these claims were addressed in the office action. Claim 1 14 is directed to an 
information management system that includes an analyser operable in conjunction with policy 
data to monitor outbound data from a workstation and to determine, in accordance with said rules 
in said policy data, an appropriate encryption strength for the outbound data; wherein said 
analyser controls transmission of said outbound data from said application in dependence upon 
said determination of an appropriate encryption strength . As explained in further detail in 
Applicant's Response (pages 4-5), these elements are neither disclosed, nor suggested by Shwed. 
Claim 114 and its dependent claims 115-135 are thus patentable over Shwed. 

As discussed in Applicant's Response (page 5), independent claims 136 and 476 also 
generally relate to determining an appropriate encryption strength for outbound data and 
controlling transmission accordingly. These claims and their respective dependent claims are 
similarly patentable over Shwed. 

III. Independent claims 178, 220 and 498 and their respective dependent claims 

None of these claims were addressed in the office action. Independent claim 178 is 
directed to an information management system that includes an analyser operable in conjunction 
with said policy data to analyse at least one of said outbound data and said inbound data, to 
identify the existence of a commercial transaction occurring between a client workstation and a 
third party by analysing said outbound or said inbound data, and to cause transaction data that is 
all or part of said outbound data or said inbound data related to an identified commercial 
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transaction to be stored in said data repository. The system can thereby, e.g., identify and store 
online transactions as they occur, providing a valuable record of data, e.g., for accounting and 
audit purposes. As explained in detail in Applicant's Response (page 6), such a system is not 
disclosed or suggested by Shwed. Claim 178 and dependent claims 179-219 are thus patentable. 

As discussed in Applicant's Response (pages 6-7), independent claims 220 and 498 also 
generally relate to identifying the existence of a commercial transaction and storing transaction 
data. These claims and their respective dependent claims are similarly patentable over Shwed. 

IV. Independent claims 304, 329 and 540 and their respective dependent claims 

None of these claims were addressed in the office action. Independent claim 304 is 
directed to an information management system that includes an analyser operable in conjunction 
with said policy data to identify in at least said outbound data, transaction data that may be part 
of a transaction , and to make a determination in accordance with said rules of said policy data as 
to whether the transmission of said transaction data would satisfy said rules; and wherein the 
transmission of said transaction data by said application is dependent on said determination made 
by said analyser. As a non-limiting example, the system is able to allow the commercial 
transactions of a plurality of users to be managed centrally, allowing a financial director, say, to 
review transactions before they occur, or even possibly to prevent them. 

Shwed in no way discloses or suggests a system in which commercial transactions are 
identified. It therefore has no rule for identifying transaction data, and as mentioned above is 
only concerned with the security of a messaging system. 

As discussed in Applicant's Response (pages 7-8), independent claims 329 and 540 also 
generally relate to identifying transaction data that may be part of a transaction and transmitting 
the transaction data. These claims and their respective dependent claims are similarly patentable 
over Shwed. 

V. Independent claims 377, 398 and 565 and their respective dependent claims 
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None of these claims were addressed in the office action. Independent claim 377 is 
directed to an information management system that includes an analyser operable in conjunction 
with said application to monitor said inbound data and to identify in at least said inbound data, 
signed data that has been digitally signed with a digital certificate, to extract one or more details 
of said signed data and to determine whether or not verification is required for said digital 
certificate . The system also includes policy data, accessible by said analyser, containing rules 
which define whether or not verification is required for said digital certificate . The analyser 
determines whether or not verification is required for said digital certificate in dependence on 
said rules of said policy data and in dependence on said one or more details of said signed data 
extracted by said analyser . 

Shwed is only concerned with the security of a network. The reference does not mention 
digital certificates, much less any functionality to manage how and when their authenticity is to 
be verified. Claim 377 and dependent claims 378-397 are patentable over Shwed. 

As discussed in Applicant's Response (pages 8-9), independent claims 398 and 565 also 
generally relate to identifying signed data that has been digitally signed with a digital certificate 
and determining whether or not verification is required. These claims and their respective 
dependent claims are similarly patentable over Shwed. 

For the reasons set forth above, the claim rejections should be withdrawn. 



Date: November 23, 2005 

Wilmer Cutler Pickering Hale and Dorr LLP 

60 State Street 

Boston, MA 02109 

(617) 526-6505 

(617) 526-5000 (Facsimile) 



Respectfully submitted, 




Rajesh Vallabh (Reg. No. 35,761) 
Attorney for Applicants 
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